Live Hacking: Breaking into Your Web App
summary
Live hacking demos exploit real weaknesses in a sample app (Goof) to show how common supply‑chain choices bite: crafted HTTP headers trigger OGNL header RCE against an old Apache Struts instance on Heroku; path traversal with percent‑encoding reads files via a vulnerable st static file lib; a long regex string causes ReDoS on Node regex; a zip upload performs Zip Slip overwrite of native2ascii, and an outdated Tomcat image yields a JSP web shell. Scans reveal npm >1.3M packages, median vuln disclosure ~2.5 years, and hundreds of OS CVEs in default Docker images; fixes are concrete: update libs, scan local/CI/docker daily, and enforce least privilege.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:25DevSecOps
- 3:13What are the problems?
- 5:22How bad is the situation?
- 7:41Demo
- 11:05Your app's code
- 13:02Serverless example
- 14:36Spring serverless example
- 15:54Open source usage has exploded
- 19:56Live hacking/Demo
- 31:21Docker
- 35:57What's the solution?
- 38:35DveSecOps in your SDLC
- 40:25Resources
- 40:47Outro
related talks
46mLive hacking: Breaking into your Java web app
47mLive Hacking: Breaking into Your Web App
40mLive hacking: Breaking into your web app
01h 02mLive Hacking: Breaking into your Web App
01h 06mLive hacking: Breaking into your Java web app
43mLive hacking: Breaking into your Java web app
52mDevSecOps
18mLive Exploiting Your Open Source Dependencies